New WordPress hack/virus

i am using wordpress 3.5.1 and lately my site was hacked (18/4).

as a result my site stopped completely loading returning blank page.

i found new folder in wp-content/plugins called “tv1”. it contains 3 files

class-wp-importer-cron.php
mod_system.php
tumblr-importer.php

this is the actual hack, especially file “mod_system.php”. it is chmoded to CHMOD 200 so you cant normally view it. after changing chmod you can view the file and you see actual virus which basically does lot of nasty thing with the whole server.

code here: http://pastebin.com/wFC0xhEC

i didnt analyze it all as it has 68 kB of code in it but it hacks your admin user for sure and also creates shell to access your server.

i would appreciate if someone could fix this ASAP as it is very serious bug or at least point me in direction what is causing this.

i am really annoyed by fixing my wordpress every 2 months for new viruses and malware…